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WHAT IS CLAIMED IS: 

1 . A method for use in a session-oriented network, comprising: 

for each session with a given endpoint, said each session comprising packets 
exchanged between said given endpoint and another endpoint, said packets having one or 
both of control and payload data, creating a parallel session havmg payload data mirroring 
all payload data of said each session which is destined for said given endpoint. 

2. The method of claim 1 wherein said each session with a given endpoint is an original 
session and further comprising: 

in a given parallel session, receiving control information; and 

for a particular original session from which said given parallel session was derived, 
injecting said control information in said particular original session directed to said given 
endpoint and to said another endpoint for said particular original session. 

3. The method of claim 2 wherein said creating a parallel session fiirther comprises creating 
said parallel session having control information mirroring all control information of said 
each original session. 

4. The method of claim 3 wharein said control information injected into said particular 
original session is a session termination command. 

5. The method of claim 4 wherein said netwoik follows internet protocoL 

6. The method of claim 5 wherein said network follows transport control protocol. 

7. The method of claim 6 fiirther comprising tracking sequence numbers of said particular 
original session and wherein said injecting said control information in said particular 
original session comprises injecting control information together with expected sequence 
numbers. 

8. The method of claim 7 wherein said given endpoint is a server for satisfying browser- 
based requests. 
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9. The method of claim 7 wherein said given endpoint is a server for providing web 
services. 

10. The method of claim 1 wherein said each session with a given endpoint is an original 
session and wherem a given parallel session has an initial sequence number differing from 
an initial sequence number of a particular original session from which said given parallel 
session was derived. 

1 1. The method of claim 1 further comprising screening said payload data for illegitimate 
requests. 

12. The method of claim 1 1 wherein said each session with a given endpoint is an original 
session and further comprising: 

on finding an illegitimate request in respect of a given original session, injecting a 
session termination command into said given original session directed to said given 
endpoint and to said another endpoint for said particular original session. 

13. The method of claim 1 further comprising screening said payload data for events. 

14. The method of claim 13 wherein said each session with a given endpoint is an original 
session and further comprising: 

on determining an event in respect of a given original session, logging said event. 

15. The method of claim 14 wherein said ev^t is an e-mail message having certain 
parameters. 

16. A session re-constructor, comprising: 

an interface for connection to a session-oriented networic; 
an interface for connection to a given oadpoint; 

a processor for, for each session with said given endpoint, said each session 
comprising packets exchanged between said giv^ endpoint and another endpoint, said 
packets having one or both of control and payload data, creating a parallel session having 
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payload data mirroring all payload data of said each session which is destined for said given 
endpoint. 



17. The session re-constructor of claim 16 further comprising a memory storing a table with 
information on said each session, said information comprising an address of said another 
endpoint, a port number of said another endpoint, a sequence number of said another 
endpoint, a port nimiber of said given endpoint, and a sequence number of said given point. 

18. A computer readable medium containing computer executable instructions for causing a 
processor connected into a session-oriented networic to: 

for each session with a given endpoint, said each session comprising packets 
exchanged between said given endpoint and another endpoint, said packets having one or 
both of control and payload data, creating a parallel session having payload data mirroring 
all payload data of said each session which is destined for said given endpoint. 
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